CVE-2023-53741

CVE-2023-53741 is a weak session management vulnerability (CWE-384) in Screen SFT DAB version 1.9.3, where session identifiers are bound to IP addresses. This flaw allows attackers to bypass authentication controls by intercepting and reusing established session identifiers via the vulnerable API. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), highlighting high integrity and availability impacts with no confidentiality loss.

Attackers with adjacent network access can exploit this without privileges or user interaction by capturing a valid session from a legitimate user and replaying the IP-bound session ID to the API. Successful exploitation enables unauthorized actions, such as removing user accounts, compromising system integrity and availability.

Advisories and related resources, including VulnCheck's detailed report (https://www.vulncheck.com/advisories/screen-sft-dab-authentication-bypass-via-ip-session-management), vendor pages from DB Broadcast (https://www.dbbroadcast.com and https://www.dbbroadcast.com/products/radio/sft-dab-series-compact-air/) and Screen (https://www.screen.it), provide further context. A proof-of-concept exploit is publicly available on Exploit-DB (https://www.exploit-db.com/exploits/51457), underscoring the need to review these for patch availability and mitigation guidance.